Android.Triada.4585

Technical information

Malicious functions:

Executes code of the following detected threats:

Android.DownLoader.906.origin
Android.Triada.4567
Android.Triada.482.origin

Network activity:

Connects to:

UDP(DNS) <Google DNS>
TCP(HTTP/1.1) t####.a####.top:80
TCP(HTTP/1.1) wap.78####.cc:80
TCP(HTTP/1.1) de.gtp.xy####.com:8844
TCP(HTTP/1.1) cdn.info####.me:80
TCP(HTTP/1.1) gd.a.s####.com:80
TCP(HTTP/1.1) www.x####.cn:80
TCP(HTTP/1.1) res####.a####.top:80
TCP(HTTP/1.1) cpd.ohyeah####.com:80
TCP(HTTP/1.1) ti####.c####.l####.####.com:80
TCP(HTTP/1.1) c####.c####.cn:80
TCP(HTTP/1.1) s####.jom####.com:80
TCP(HTTP/1.1) d####.cn:80
TCP(HTTP/1.1) ff.s####.com:8080
TCP(HTTP/1.1) dup.baidust####.com:80
TCP(HTTP/1.1) www.pc####.com.####.cn:80
TCP(HTTP/1.1) xua####.bugse####.com:3002
TCP(HTTP/1.1) d.sin####.cn.####.net:80
TCP(HTTP/1.1) t####.c####.com:80
TCP(HTTP/1.1) r.ist####.com:8071
TCP(HTTP/1.1) tu.4####.cn.####.net:80
TCP(HTTP/1.1) ad.l####.com:3000
TCP(HTTP/1.1) ni####.bugse####.com:3001
TCP(HTTP/1.1) d####.c####.l####.####.com:80
TCP(HTTP/1.1) s####.x####.com.cn:80
TCP(HTTP/1.1) pos.b####.com:80
TCP(HTTP/1.1) d0.x####.com.cn:80
TCP(HTTP/1.1) m.8####.com:80
TCP(HTTP/1.1) 58.2####.92.50:808
TCP(HTTP/1.1) ad.smudge####.com:8986
TCP(HTTP/1.1) a####.d####.com:80
TCP(HTTP/1.1) ott.h####.com:8071
TCP(HTTP/1.1) api.liyan####.com:808
TCP(HTTP/1.1) a####.w####.com:80
TCP(HTTP/1.1) ad.l####.com:3001
TCP(HTTP/1.1) j####.g####.vip:80
TCP(HTTP/1.1) js.pass####.qih####.####.com:80
TCP(HTTP/1.1) pco####.ta####.com:80
TCP(HTTP/1.1) m.xiaoshu####.cn:80
TCP(HTTP/1.1) www.78####.cc:80
TCP(HTTP/1.1) s.zhito####.com:808
TCP(HTTP/1.1) 4####.91.3.20:20147
TCP(HTTP/1.1) s5.q####.com:80
TCP(HTTP/1.1) tin####.c####.l####.####.com:80
TCP(HTTP/1.1) b####.bugse####.com:80
TCP(HTTP/1.1) yq####.jn####.ltd:80
TCP(HTTP/1.1) i.ist####.com:8071
TCP(HTTP/1.1) qiniust####.jom####.com:80
TCP(HTTP/1.1) ne####.x####.com.cn:80
TCP(HTTP/1.1) t####.x####.com.cn:80
TCP(HTTP/1.1) yun.b####.com:80
TCP(HTTP/1.1) xua####.bugse####.com:80
TCP(HTTP/1.1) m.1####.com:80
TCP(HTTP/1.1) php.sho####.com:80
TCP(HTTP/1.1) pg####.d2####.com:10273
TCP(HTTP/1.1) r1.baiyuns####.com:80
TCP(HTTP/1.1) api.yunco####.com:80
TCP(HTTP/1.1) ad.w####.com:80
TCP(HTTP/1.1) ad.l####.com:80
TCP(HTTP/1.1) yb.bugse####.com:80
TCP(HTTP/1.1) q####.c####.l####.####.com:80
TCP(HTTP/1.1) ip.j####.com:999
TCP(HTTP/1.1) gm.mm####.com:80
TCP(HTTP/1.1) api.lubang####.com:80
TCP(HTTP/1.1) www.f####.com:80
TCP(HTTP/1.1) f.qia####.com:80
TCP(HTTP/1.1) 2####.b####.com:80
TCP(HTTP/1.1) s.3####.cn:80
TCP(HTTP/1.1) a.78####.cc:80
TCP(HTTP/1.1) ni####.bugse####.com:80
TCP(HTTP/1.1) z.c####.com:80
TCP(HTTP/1.1) etc.jiguang####.com.####.com:80
TCP(HTTP/1.1) a####.qia####.com:80
TCP(HTTP/1.1) w####.pcon####.com.cn:80
TCP(HTTP/1.1) ni####.bugse####.com:3002
TCP(HTTP/1.1) d1.sho####.com:80
TCP(HTTP/1.1) down####.baiyuns####.com:80
TCP(HTTP/1.1) ny.bul####.cn:666
TCP(HTTP/1.1) luozias####.b0.a####.com:80
TCP(HTTP/1.1) m.b####.net:80
TCP(HTTP/1.1) 58.2####.198.157:999
TCP(HTTP/1.1) p.ist####.com:8071
TCP(HTTP/1.1) api.s####.xin:80
TCP(HTTP/1.1) 47.1####.59.53:900
TCP(HTTP/1.1) s.zhito####.com:807
TCP(HTTP/1.1) 1####.207.229.172:80
TCP(HTTP/1.1) v.sho####.com:80
TCP(HTTP/1.1) api.adoc####.com:80
TCP(HTTP/1.1) ad.l####.com:3002
TCP(HTTP/1.1) 47.1####.185.46:80
TCP(HTTP/1.1) co####.ssp.adoc####.com:80
TCP(HTTP/1.1) log.gtp.xy####.com:80
TCP(HTTP/1.1) vvv.focusd####.cn:80
TCP(HTTP/1.1) i####.xca####.com.####.cn:80
TCP(HTTP/1.1) api.g####.vip:80
TCP(HTTP/1.1) p####.api.adoc####.com:80
TCP(HTTP/1.1) ssph####.cn-hang####.log.####.com:80
TCP(HTTP/1.1) b####.bugse####.com:3002
TCP(HTTP/1.1) c.c####.com:80
TCP(HTTP/1.1) yb.bugse####.com:3001
TCP(HTTP/1.1) res2####.xqk####.com:80
TCP(HTTP/1.1) b####.bugse####.com:3000
TCP(HTTP/1.1) api.gug####.com:8935
TCP(HTTP/1.1) zgx.powerle####.com:80
TCP(HTTP/1.1) pc.b####.com:80
TCP(HTTP/1.1) w.i####.com:80
TCP(HTTP/1.1) f####.c####.com.####.com:80
TCP(HTTP/1.1) w####.c####.com:80
TCP(HTTP/1.1) 47.1####.211.73:80
TCP(HTTP/1.1) e4####.0r####.com:10293
TCP(HTTP/1.1) h.w####.com:80
TCP(HTTP/1.1) 1####.246.20.201:80
TCP(HTTP/1.1) j####.qq.com:80
TCP(HTTP/1.1) ask.c####.com.####.com:80
TCP(SSL/3.0) ad1.azh####.com:9190
TCP(SSL/3.0) p.ssl.q####.com:443
TCP(TLS/1.0) z.c####.com:443
TCP(TLS/1.0) i####.51.la:443
TCP(TLS/1.0) kk####.cn:443
TCP(TLS/1.0) c####.pc####.com.cn:443
TCP(TLS/1.0) gm.mm####.com:443
TCP(TLS/1.0) pos.b####.com:443
TCP(TLS/1.0) a####.d####.com:443
TCP(TLS/1.0) www.google-####.com:443
TCP(TLS/1.0) u.j####.com:443
TCP(TLS/1.0) mo.sd####.xyz:443
TCP(TLS/1.0) gd.a.s####.com:443
TCP(TLS/1.0) wtc.d####.com:443
TCP(TLS/1.0) p.ssl.q####.com:443
TCP(TLS/1.0) wl.jd.com.####.com:443
TCP(TLS/1.0) etc.jiguang####.com.####.com:443
TCP(TLS/1.0) www.pcon####.com.cn:443
TCP(TLS/1.0) jr.pc####.com.cn:443
TCP(TLS/1.0) id.d####.com:443
TCP(TLS/1.0) mfs.y####.com:443
TCP(TLS/1.0) p####.m.jd.com:443
TCP(TLS/1.0) i####.d####.com:443
TCP(TLS/1.0) counter####.pc####.com.cn:443
TCP(TLS/1.0) api.g####.vip:443
TCP(TLS/1.0) img.pc####.com.cn:443
TCP(TLS/1.0) 27.2####.28.198:443
TCP(TLS/1.0) mg####.pcon####.com.cn:443
TCP(TLS/1.0) qdl.d####.com:443
TCP(TLS/1.0) q####.c####.l####.####.com:443
TCP(TLS/1.0) www.pc####.com.####.cn:443
TCP(TLS/1.0) img.d####.com:443
TCP(TLS/1.0) p####.pc####.com.cn:443
TCP(TLS/1.0) c.c####.com:443
TCP(TLS/1.0) ivy.pcon####.com.cn:443
TCP(TLS/1.0) pp.c####.com:443
TCP(TLS/1.0) hm.b####.com:443
TCP(TLS/1.0) ec####.b####.com:443
TCP(TLS/1.0) dup.baidust####.com:443
TCP(TLS/1.0) js.3con####.com.####.cn:443
TCP(TLS/1.0) h####.cn:443
TCP(TLS/1.0) 2####.b####.com:443
TCP(TLS/1.0) api.adoc####.com:443
TCP(TLS/1.0) g####.c####.cn:443
TCP(TLS/1.0) sw4.d####.com:443
TCP(TLS/1.0) api.info####.me:443
TCP(TLS/1.0) spl.z####.com:443
TCP(TLS/1.0) ad1.azh####.com:9190
TCP 39.97.1####.60:9091
TCP gw.adx####.com:8080

DNS requests:

2####.b####.com
4s####.8c####.com
a####.d####.com
a####.qia####.com
a####.w####.com
a.78####.cc
ad.l####.com
ad.smudge####.com
ad.w####.com
ad1.azh####.com
api.adoc####.com
api.g####.vip
api.gug####.com
api.info####.me
api.liyan####.com
api.lubang####.com
api.s####.b####.com
api.s####.xin
api.yunco####.com
ask.c####.com
ass####.xca####.com
b####.bugse####.com
b####.bugse####.com
ba####.c####.com
c####.c####.cn
c####.mm####.com
c####.pc####.com.cn
c.c####.com
cdn####.f####.top
cdn.boo####.com
cdn.info####.me
co####.ssp.adoc####.com
counter####.pc####.com.cn
cpd.ohyeah####.com
d####.cn
d0.x####.com.cn
d1.sho####.com
de.gtp.xy####.com
down####.baiyuns####.com
dup.baidust####.com
e4####.0r####.com
ec####.b####.com
etc.jiguang####.com
f####.c####.com
f.qia####.com
ff.s####.com
g####.c####.cn
gw.adx####.com
h####.c####.com
h####.cn
h.w####.com
hm.b####.com
i####.360bu####.com
i####.51.la
i####.c####.com
i####.d####.com
i####.x####.com.cn
i####.xca####.com
i####.xca####.com
i.ist####.com
id.d####.com
img.d####.com
img.pc####.com.cn
ip.j####.com
ip.remo####.com
ivy.pc####.com.cn
ivy.pcon####.com.cn
j####.g####.vip
j####.qq.com
jr.pc####.com.cn
js.3con####.com
js.pass####.qih####.com
js.x####.com.cn
kk####.cn
kou####.a####.top
lg.ca####.com
log.gtp.xy####.com
m.1####.com
m.360bu####.com
m.8####.com
m.b####.net
m.xiaoshu####.cn
mg####.pcon####.com.cn
mo.sd####.xyz
ne####.x####.com.cn
ni####.bugse####.com
ny.bul####.cn
o.fj####.com
ott.h####.com
p####.api.adoc####.com
p####.b####.com
p####.m.jd.com
p####.pc####.com.cn
p####.zhanz####.b####.com
p.ist####.com
p.ssl.q####.com
pc.b####.com
pco####.c####.com
pg####.d2####.com
php.sho####.com
pic.xca####.com
pos.b####.com
pp.c####.com
pv.s####.com
qdl.d####.com
r.ist####.com
r1.baiyuns####.com
r1.y####.com
res####.a####.top
res2####.xqk####.com
s####.d####.com
s####.d####.com
s####.x####.com.cn
s.3####.cn
s.zhito####.com
s11.c####.com
s13.c####.com
s19.c####.com
s20.c####.com
s22.c####.com
s23.c####.com
s4.c####.com
s5.c####.com
s5.q####.com
s9.c####.com
s95.c####.com
s96.c####.com
spl.z####.com
ssph####.cn-hang####.log.####.com
st####.duo####.com
sto####.360bu####.com
sw4.d####.com
t####.a####.top
t####.c####.com
t####.x####.com.cn
tc.c####.com
tjs.sjs.si####.cn
tt####.vni####.com
tu.4####.cn
u####.a####.top
u.j####.com
ucst####.c####.com
v.h####.com
v.sho####.com
v1.c####.com
vn.x####.com.cn
vvv.focusd####.cn
w####.c####.com
w####.jd.com
w####.pc####.com.cn
w####.pcon####.com.cn
w.i####.com
wap.78####.cc
wtc.d####.com
www.78####.cc
www.78####.cc
www.c####.com
www.f####.com
www.google-####.com
www.pc####.com.cn
www.pcon####.com.cn
www.x####.cn
wz.78####.cc
xua####.bugse####.com
yb.bugse####.com
yq####.jn####.ltd
yun.b####.com
z1.c####.com
z11.c####.com
z12.c####.com
z2.c####.com
z3.c####.com
z5.c####.com
z6.c####.com
z7.c####.com
z8.c####.com
z9.c####.com
zgx.powerle####.com

HTTP GET requests:

2####.b####.com/ms/a.js?b=####&u=5!6.0####&c=1!0!x####&f=####
2####.b####.com/ms/d.js?b=####&n=####&a=####
58.2####.92.50:808/ghyd.html
a####.d####.com/rewrite?fromid=####
a.78####.cc/index/upapp/app_datas?upapp_id=####&imei=####&channel_id=####
ad.l####.com/ad
ad.l####.com:3000/api?rdtime=####&id=####&osv=####&imei=####&adid=####&m...
ad.l####.com:3001/api?rdtime=####&id=####&osv=####&imei=####&adid=####&m...
ad.l####.com:3002/api?rdtime=####&id=####&osv=####&imei=####&adid=####&m...
api.adoc####.com/titan/monitor/device_info
api.g####.vip/cy.js
ask.c####.com.####.com/baike/d/871.html
ask.c####.com.####.com/baike/js/global_js.js
ask.c####.com.####.com/baike/js/jquery.cookie.js
ask.c####.com.####.com/baike/styles/index9.css
ask.c####.com.####.com/index/styles/css/basic.css?v=####
ask.c####.com.####.com/index/styles/css/index20180829_2.css
ask.c####.com.####.com/index/styles/css/loginface.css?v=####
ask.c####.com.####.com/index/styles/js/add_new_20160528k.js
ask.c####.com.####.com/index/styles/js/changePic.js
ask.c####.com.####.com/index/styles/js/index.js
ask.c####.com.####.com/index/styles/js/jquery.SuperSlide.js
ask.c####.com.####.com/index/styles/js/jquery.mscroll.js
ask.c####.com.####.com/index/styles/js/jquery_172.js
ask.c####.com.####.com/index/styles/js/marquee.js
ask.c####.com.####.com/js/notice.js
ask.c####.com.####.com/main.html
b####.bugse####.com/ad
b####.bugse####.com:3000/api?rdtime=####&id=####&osv=####&imei=####&adid...
b####.bugse####.com:3002/api?rdtime=####&id=####&osv=####&imei=####&adid...
c####.c####.cn/stat.php?site_id=####
c.c####.com/core.php?web_id=####&show=####&t=####
c.c####.com/core.php?web_id=####&t=####
c.c####.com/img/pic.gif
c.c####.com/stat.php?id=####
c.c####.com/stat.php?id=####&web_id=####
c.c####.com/z_stat.php?id=####
c.c####.com/z_stat.php?id=####&show=####
c.c####.com/z_stat.php?id=####&web_id=####
cdn.info####.me/files/ea41d1cfef35fc335f11c1026762070c
co####.ssp.adoc####.com/api/v2/SDKCommonConfig?channelCode=####&version=...
co####.ssp.adoc####.com/api/v2/fwConfig?channelCode=####&version=####
co####.ssp.adoc####.com/api/v2/fwWebviewRatioConfig?channelCode=####&ver...
co####.ssp.adoc####.com/api/v2/mgmConfig?channelCode=####&version=####
co####.ssp.adoc####.com/api/v2/mgmWebviewRatioConfig?channelCode=####&ve...
cpd.ohyeah####.com/APKData/GetList?APILevel=18&AndroidId=c159657daa50349...
d####.c####.l####.####.com/api.jar
d####.c####.l####.####.com/lijian.jar
d####.c####.l####.####.com/sspkid33.jar
d####.cn/fenpei.html?3####
d####.cn/ywm.html
d.sin####.cn.####.net/open/api/js/wb.js
d0.x####.com.cn/adpush/push/ad.php?pid=####&pushtype=####&cid=####&style...
d0.x####.com.cn/pvlog/ad_count.php?t=####
down####.baiyuns####.com/80syc/80sycphone.css
down####.baiyuns####.com/80syc/arrow.png
down####.baiyuns####.com/80syc/jquery.min.js
down####.baiyuns####.com/80syc/logo.gif
down####.baiyuns####.com/80syc/search.png
down####.baiyuns####.com/80syc/top.png
down####.baiyuns####.com/cy.js
down####.baiyuns####.com/jquery.lazyload.min.js
down####.baiyuns####.com/jquery.min.js
down####.baiyuns####.com/static/default.css
down####.baiyuns####.com/static/index.js
down####.baiyuns####.com/static/logo_40.png
dup.baidust####.com/js/os.js
etc.jiguang####.com.####.com/chijian_qd001.html
etc.jiguang####.com.####.com/chijian_qd001.js
f####.c####.com.####.com/ads/140106flash.html
f####.c####.com.####.com/ast/js/jquery_172.js
f####.c####.com.####.com/ast/loginface/cookielogin10.js
f####.c####.com.####.com/ast/loginface/cookielogin10.js?v=####
f####.c####.com.####.com/ast/loginface/cookielogin9.js?v=####
f####.c####.com.####.com/ast/loginface/style5.css?v=####
f####.c####.com.####.com/js/base64_cn.js
f####.c####.com.####.com/js2014/cookie20141201.js
f####.c####.com.####.com/style2014/style201508.css?v=####
f.qia####.com/e/20200106161510b_600017_v78.enc
ff.s####.com:8080/ttad/api/jv5/ipkYjXUqPXLbo2wJuiygGA==/c159657daa503498...
gd.a.s####.com/cityjson
gd.a.s####.com/cityjson?ie=####
gm.mm####.com/9.gif?abc=####&rnd=####
i####.xca####.com.####.cn/PicLib/s/s10468_420.jpg
i####.xca####.com.####.cn/PicLib/s/s10571_420.jpg
i####.xca####.com.####.cn/PicLib/s/s10656_420.jpg
i####.xca####.com.####.cn/PicLib/s/s11942_420.jpg
i####.xca####.com.####.cn/PicLib/s/s7778_120.jpg
i####.xca####.com.####.cn/PicLib/s/s9397_420.jpg
i####.xca####.com.####.cn/b160/s10186/m_20181026094755254235653039951.jpg
i####.xca####.com.####.cn/b160/s10186/s_20181026094755038646658190393.jpg
i####.xca####.com.####.cn/b160/s10186/s_20181026094755254235653039951.jpg
i####.xca####.com.####.cn/b160/s10582/s_20181022113359608269426821460.jpg
i####.xca####.com.####.cn/b160/s10582/s_20181022113401115309887743516.jpg
i####.xca####.com.####.cn/b5/s9402/m_20180117201535106031545716985.jpg
i####.xca####.com.####.cn/b5/s9402/s_20171012155928934746647762616.jpg
i####.xca####.com.####.cn/b5/s9402/s_20171012155931884993851431482.jpg
i####.xca####.com.####.cn/b5/s9402/s_20180117201531665267942535595.jpg
i####.xca####.com.####.cn/b5/s9402/s_20180117201535106031545716985.jpg
i####.xca####.com.####.cn/b59/s7483/m_20161110115047671488830964034.jpg
i####.xca####.com.####.cn/b59/s7483/s_20161110115046171389113599319.jpg
i####.xca####.com.####.cn/b59/s7483/s_20161110115047671488830964034.jpg
i####.xca####.com.####.cn/b59/s7483/s_20181128162705520799556192399.jpg
i####.xca####.com.####.cn/b59/s7483/s_20181128162717738485255863612.jpg
i####.xca####.com.####.cn/b59/s9419/20180316233245718211693282797.jpg-28...
i####.xca####.com.####.cn/b59/s9419/20180316233914588745959918692.jpg-12...
ip.j####.com:999/wap/index.php?0####
j####.g####.vip/15kxs.js
j####.g####.vip/fd.js
j####.g####.vip/ggx.js
j####.g####.vip/ggx3.js
j####.g####.vip/syc3.js
j####.g####.vip/xs240.js
j####.qq.com/get?api=####
js.pass####.qih####.####.com/11.0.1.js?90057d8####
luozias####.b0.a####.com/ip/lw/qd001.html
luozias####.b0.a####.com/ip/lw/qd001.js
m.1####.com/mbindex_10372/457.html
m.1####.com/mbindex_17246/
m.1####.com/mbook_images/header-back.gif
m.1####.com/mbook_images/header-backhome.gif
m.1####.com/mbook_js/common.js
m.1####.com/mbook_js/index.js
m.1####.com/mbook_js/read.js
m.1####.com/mbook_js/stat.js
m.1####.com/mbook_js/yuedu.js
m.1####.com/mbook_js/zepto.min.js
m.8####.com/js/ads/lmgg.js
m.8####.com/view/12236.html
m.8####.com/view/12425.html
m.b####.net/mbook_images/defaultimg.png
m.b####.net/mbook_images/header-back.gif
m.b####.net/mbook_images/header-backhome.gif
m.b####.net/mbook_images/icon-search.gif
m.b####.net/mbook_images/longview.png
m.b####.net/mbook_js/common.js
m.b####.net/mbook_js/sort.js
m.b####.net/mcls_rank_1_5/
m.xiaoshu####.cn/mbook_images/header-back.gif
m.xiaoshu####.cn/mbook_images/header-backhome.gif
m.xiaoshu####.cn/mbook_js/common.js
m.xiaoshu####.cn/mbook_js/index.js
m.xiaoshu####.cn/mbook_js/read.js
m.xiaoshu####.cn/mbook_js/yuedu.js
m.xiaoshu####.cn/mbook_js/zepto.min.js
m.xiaoshu####.cn/mbxs240/2113/379_1.html
ne####.x####.com.cn/auto/index.php?r=####&c=####&p=####&m=####
ne####.x####.com.cn/auto/index.php?r=####&pserid=####&city_id=####&provi...
ne####.x####.com.cn/images/np_ps_bj.jpg
ne####.x####.com.cn/images/r_map.gif
ne####.x####.com.cn/images/rl_bj.gif
ne####.x####.com.cn/js/Jump.js?v=####
ne####.x####.com.cn/jsinclude/jquery.js
ne####.x####.com.cn/new_ol_1371.html
ne####.x####.com.cn/new_ol_config23.html
ne####.x####.com.cn/new_ol_config33.html
ne####.x####.com.cn/new_ol_config35.html
ne####.x####.com.cn/new_ol_news15.html
ne####.x####.com.cn/new_ol_news2356.html
ne####.x####.com.cn/new_ol_news27.html
ne####.x####.com.cn/new_ol_news98.html
ne####.x####.com.cn/new_ol_photo14.html
ne####.x####.com.cn/new_ol_photo3.html
ne####.x####.com.cn/new_ol_photo8.html
ne####.x####.com.cn/xcarjump/new_jump_other.php
ni####.bugse####.com/ad
ni####.bugse####.com:3001/api?rdtime=####&id=####&osv=####&imei=####&adi...
ni####.bugse####.com:3002/api?rdtime=####&id=####&osv=####&imei=####&adi...
p####.api.adoc####.com/ip
pc.b####.com/v
pco####.ta####.com/app.gif?&cna=####
pos.b####.com/ccdm?psi=91838c285c432e5f0cda8079282949c2&di=6611856&dri=0...
pos.b####.com/iccm?psi=da92b7a971ed0b4f502564b45a8527f2&di=5897808&dri=0...
pos.b####.com/ocnm?psi=2e181beca73344a3397e686e5d8f7ec0&di=5897808&dri=0...
pos.b####.com/ucim?psi=8bfc4f627690e8bbe7c418aaec689964&di=6611856&dri=0...
q####.c####.l####.####.com/PicLib/logo/bl59_40.jpg
q####.c####.l####.####.com/PicLib/logo/pl2_40.jpg
q####.c####.l####.####.com/PicLib/logo/pl3_40.jpg
q####.c####.l####.####.com/PicLib/logo/pl54_40.jpg
qiniust####.jom####.com/common/1.7.2.min.js
qiniust####.jom####.com/resource/common/statistic/iwt-min.js
qiniust####.jom####.com/resource/newcar/ps/nav.js?v=####
qiniust####.jom####.com/source/search/search.r.js?v=####
qiniust####.jom####.com/source/search/search_emptyfns.r.js
qiniust####.jom####.com/source/search/search_exec.r.js?v=####
qiniust####.jom####.com/source/search/search_tpl_c1.r.js?v=####
qiniust####.jom####.com/source/search/search_tpl_c2.r.js?v=####
qiniust####.jom####.com/tools/jq/1.9-nol.js
qiniust####.jom####.com/tools/requirejs/2.3.js?v=####
res####.a####.top/sdk1.png
res####.a####.top/sdk13_4.png
res####.a####.top/sdk15.png
res####.a####.top/sdk17.png
res####.a####.top/sdk18.png
res####.a####.top/sdk24_1.png
res####.a####.top/sdk3.png
res####.a####.top/sdk4_1.png
res####.a####.top/sdk5_2.png
res####.a####.top/sdk9.png
res2####.xqk####.com//25/5/海贼之不祥暗影/cover.jpg
res2####.xqk####.com//35/5/我真是个富二代/cover.jpg
res2####.xqk####.com//52/2/捡了一片荒野/cover.jpg
res2####.xqk####.com//53/3/DNF侵入漫威/cover.jpg
res2####.xqk####.com//53/3/变身之我真不是NPC/cover.jpg
res2####.xqk####.com//61/1/重生1980之强国崛起/cover.jpg
res2####.xqk####.com//71/1/曙光纪元/cover.jpg
res2####.xqk####.com//82/2/重生成为树/cover.jpg
res2####.xqk####.com//87/7/我的次元聊天室/cover.jpg
res2####.xqk####.com//95/5/史上最难开启系统/cover.jpg
s####.jom####.com/push.js
s####.jom####.com/s.gif?r=####&l=####
s####.x####.com.cn/flow/flow.php?m=####
s####.x####.com.cn/flow/flow.php?q=####
s####.x####.com.cn/flow/flow.php?t=####
s.3####.cn/so/zz.gif?url=####&sid=####&token=####
s.zhito####.com:807/528/jd0622.html
s.zhito####.com:808/0622/index.html
s.zhito####.com:808/0622/yrc_001mobile.js
s5.q####.com/static/ab77b6ea7f3fbf79.js
ssph####.cn-hang####.log.####.com/logstores/system/track_ua.gif?APIVersi...
t####.a####.top/channl_haoqi1.png
t####.a####.top/kouling.json
t####.a####.top/req.json
t####.c####.com/d/css/style.css?v=####
t####.c####.com/d/tree.php?treeid=####
t####.x####.com.cn/ip2city/ip2getcity.php?_t=####&s=####
ti####.c####.l####.####.com/2011newcar/images/calculate.gif
ti####.c####.l####.####.com/2011newcar/images/t0420_detailed.png
ti####.c####.l####.####.com/2011newcar/images/t0709_aria.gif
ti####.c####.l####.####.com/2011newcar/images/wb_btn1.jpg
ti####.c####.l####.####.com/2015/nav/css/channel_nav.css?v=####
ti####.c####.l####.####.com/2015/nav/images/Header_bg.gif?v=####
ti####.c####.l####.####.com/2015/nav/images/xcar_logov@2x.png?v=####
ti####.c####.l####.####.com/2016/DemioModel/css/common.css?version=####
ti####.c####.l####.####.com/2016/DemioModel/css/demion_v1.css?v=####
ti####.c####.l####.####.com/2016/DemioModel/css/demion_v1.css?version=####
ti####.c####.l####.####.com/2016/DemioModel/images/200.jpg
ti####.c####.l####.####.com/2016/DemioModel/images/DemioModel.png
ti####.c####.l####.####.com/2016/DemioModel/images/DemioModel.png?v####
ti####.c####.l####.####.com/2016/DemioModel/images/jq.png
ti####.c####.l####.####.com/2016/DemioModel/images/ky.png
ti####.c####.l####.####.com/2016/DemioModel/images/sz.png
ti####.c####.l####.####.com/min/?f=####&v=####
ti####.c####.l####.####.com/min/?f=####&version=####
ti####.c####.l####.####.com/review/js/city_arr_2008.js
ti####.c####.l####.####.com/ss/newsearch/css/search.css
tin####.c####.l####.####.com/TTT021_028.y
tu.4####.cn.####.net/MjE1Nw21572157/0113/1578896041.gif?
tu.4####.cn.####.net/MjE1Nw21572157/1220/1576835509.gif?
vvv.focusd####.cn/ad/v1/log.action?action=v_initial&package=<Package>&ch...
w####.c####.com/abc/xyz/point/index.php
w.i####.com/iwt/a.gif?url=####&ua=####&uuid=####&sign=####&ts=####
wap.78####.cc/api/cn/1
www.78####.cc/index/backend/pro_count?event_id=####&channel_id=####&proj...
www.78####.cc/index/limit/getLimit?channel=####&project=####
www.78####.cc/index/project/project_status?action=####
www.f####.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.mi...
www.f####.com/search/5A4441442D3234_1.html
www.f####.com/static/js/dist/clipboard.min.js
www.pc####.com.####.cn/autox/6a976e56b61b2febd215f6cbe5186f5f.htm
www.x####.cn/sycdd.js
xua####.bugse####.com/ad
xua####.bugse####.com/api?rdtime=####&id=####&osv=####&imei=####&adid=##...
xua####.bugse####.com:3002/api?rdtime=####&id=####&osv=####&imei=####&ad...
yb.bugse####.com/ad
yb.bugse####.com:3001/api?rdtime=####&id=####&osv=####&imei=####&adid=##...
yq####.jn####.ltd/sy/fdvdar
yq####.jn####.ltd/sy/jpiohcw
yq####.jn####.ltd/zz/401jkmhjhwy.zip
yq####.jn####.ltd/zz/436sdfbokwyf.zip
yun.b####.com/pw/666f72627974.jpg
yun.b####.com/pw/70777777.jpg
yun.b####.com/pw/765f73646b.jpg
yun.b####.com/tz/6173.jpg
yun.b####.com/xtz/1579072131.ico
z.c####.com/stat.htm?id=####&cnzz_eid=####
z.c####.com/stat.htm?id=####&r=####&lg=####&ntime=####&cnzz_eid=####&sho...
zgx.powerle####.com/dnfile/cmm/PWrap191331V945.jar
zgx.powerle####.com/dnfile/other/v6/plg_86.jpg

HTTP POST requests:

a####.qia####.com//api/2io82K
a####.qia####.com//api/8VbeIo
a####.qia####.com//api/Ddgv3VE
a####.qia####.com//api/Mny1OOW3
a####.qia####.com//api/QTnLukEdO1
a####.qia####.com//api/SEEzevU1
a####.qia####.com//api/SJoGF44Q
a####.qia####.com//api/SVFUp6
a####.qia####.com//api/voEYG7
a####.w####.com/rest/pt
ad.smudge####.com:8986/api/5/detail?businessId=####&token=####&timestamp...
ad.w####.com/api.htm?pid=####
api.gug####.com:8935/
api.liyan####.com:808/get/api
api.lubang####.com/domain.php
api.lubang####.com/srp.php
api.s####.xin/log/if0
api.s####.xin/log/p02
api.yunco####.com/service/rest
d1.sho####.com/index.php?r=####
d1.sho####.com/index.php?r=####&uid=####&tm=####&model=####&density=####...
de.gtp.xy####.com:8844/Device/info/
de.gtp.xy####.com:8844/favicon.ico
de.gtp.xy####.com:8844/i?ts=####
e4####.0r####.com:10293/widlth/
gd.a.s####.com/cityjson
h.w####.com/api/Gu5wT0Z
i.ist####.com:8071/6.0.1/1510864978/1
log.gtp.xy####.com/sdk
ny.bul####.cn:666/slsdk/api_summary.aspx
ny.bul####.cn:666/slsdk/getdata.aspx
ny.bul####.cn:666/slsdk/settings.aspx
ott.h####.com:8071/api/10
p.ist####.com:8071/1
p.ist####.com:8071/7
pg####.d2####.com:10273/dvjnzt/
pg####.d2####.com:10273/rnggno/
pg####.d2####.com:10273/tzvntp/
php.sho####.com/index.php?r=####
r.ist####.com:8071/6.0.1/163832107/2
r1.baiyuns####.com/service/rest
v.sho####.com/index.php?r=####
w####.pcon####.com.cn/ip.jsp
www.78####.cc/index/backend/pro_data

File system changes:

Creates the following files:

/data/data/####/.3WN9
/data/data/####/.5TE4.xml
/data/data/####/.6173.apk
/data/data/####/.666f72627974.apk
/data/data/####/.70777777.apk
/data/data/####/.765f73646b.apk
/data/data/####/.J1_v.xml
/data/data/####/.__mob_ad_data.xml
/data/data/####/.ef0b4ddacc046d054f437ba0af966623
/data/data/####/.fKSra
/data/data/####/.fKSra.zip
/data/data/####/1s.jar
/data/data/####/2a02b077baa09b3b178b64e03536627e.xml
/data/data/####/44367F39739CCD6BBF960E91E7DB78B2.xml
/data/data/####/4B8DB6B83129A65A2EF4DCFC1393C3B0.xml
/data/data/####/6901029832
/data/data/####/8EAD111D030291821E19A80E344C340A.xml
/data/data/####/9618302918.xml
/data/data/####/ApplicationCache.db-journal
/data/data/####/IM.xml
/data/data/####/SMF.xml
/data/data/####/XkdjsIx132mM356507059351895comm.xml
/data/data/####/XkdjsIx132mM356507059351895tasks.xml
/data/data/####/XkdjsIx132mMskey1.xml
/data/data/####/_p.xml
/data/data/####/_sh.xml
/data/data/####/ahq_spu_ti.xml
/data/data/####/akmdcmda.jar
/data/data/####/al_lcom.qlz.ulg.xml
/data/data/####/api.jar
/data/data/####/app.manager-journal
/data/data/####/atai.jar
/data/data/####/bfb0e63a6c4e352158be3df98d18dae5.xml
/data/data/####/bt.xml
/data/data/####/cfg.config.service.xml
/data/data/####/cfg.database.ad-journal
/data/data/####/com.z.hhwks.xml
/data/data/####/config.service.xml
/data/data/####/countIp.xml
/data/data/####/data.zip
/data/data/####/data_0
/data/data/####/data_1
/data/data/####/data_2
/data/data/####/data_3
/data/data/####/download.info
/data/data/####/download.tmp (deleted)
/data/data/####/dqygt556s.xml
/data/data/####/dqygt556s.xml.bak
/data/data/####/dswt54etg.data-journal
/data/data/####/dwssedjb.data-journal
/data/data/####/dwwsdws.data-journal
/data/data/####/e4de3tx.xml
/data/data/####/f_000001
/data/data/####/f_000002
/data/data/####/f_000003
/data/data/####/f_000004
/data/data/####/f_000005
/data/data/####/f_000006
/data/data/####/f_000007
/data/data/####/f_000008
/data/data/####/f_000009
/data/data/####/f_00000a
/data/data/####/f_00000b
/data/data/####/f_00000c
/data/data/####/f_00000d
/data/data/####/f_00000e
/data/data/####/f_00000f
/data/data/####/f_000010
/data/data/####/f_000011
/data/data/####/f_000012
/data/data/####/f_000013
/data/data/####/f_000014
/data/data/####/f_000015
/data/data/####/f_000016
/data/data/####/f_000017
/data/data/####/f_000018
/data/data/####/f_000019
/data/data/####/f_00001a
/data/data/####/f_00001b
/data/data/####/f_00001c
/data/data/####/f_00001d
/data/data/####/f_00001e
/data/data/####/f_00001f
/data/data/####/f_000020
/data/data/####/f_000021
/data/data/####/f_000022
/data/data/####/f_000023
/data/data/####/f_000024
/data/data/####/f_000025
/data/data/####/f_000026
/data/data/####/f_000027
/data/data/####/f_000028
/data/data/####/f_000029
/data/data/####/f_00002a
/data/data/####/f_00002b
/data/data/####/f_00002c
/data/data/####/f_00002d
/data/data/####/f_00002e
/data/data/####/f_00002f
/data/data/####/f_000030
/data/data/####/f_000031
/data/data/####/f_000032
/data/data/####/f_000033
/data/data/####/f_000034
/data/data/####/f_000035
/data/data/####/f_000036
/data/data/####/f_000037
/data/data/####/f_000038
/data/data/####/f_000039
/data/data/####/f_00003a
/data/data/####/f_00003b
/data/data/####/f_00003c
/data/data/####/f_00003d
/data/data/####/f_00003e
/data/data/####/f_00003f
/data/data/####/f_000040
/data/data/####/f_000041
/data/data/####/f_000042
/data/data/####/f_000043
/data/data/####/f_000044
/data/data/####/f_000045
/data/data/####/f_000046
/data/data/####/f_000047
/data/data/####/f_000048
/data/data/####/f_000049
/data/data/####/f_00004a
/data/data/####/f_00004b
/data/data/####/f_00004c
/data/data/####/f_00004d
/data/data/####/f_00004e
/data/data/####/f_00004f
/data/data/####/f_000050
/data/data/####/f_000051
/data/data/####/f_000052
/data/data/####/f_000053
/data/data/####/f_000054
/data/data/####/f_000055
/data/data/####/f_000056
/data/data/####/f_000057
/data/data/####/gameid
/data/data/####/gameid.zip
/data/data/####/gwu878ds.data-journal
/data/data/####/hcdml.xml
/data/data/####/hhq_spu_ti.xml
/data/data/####/hxdata.xml
/data/data/####/im.database.ad-journal
/data/data/####/index
/data/data/####/joeuhu.png
/data/data/####/liblg9417791
/data/data/####/libomnwdo.so
/data/data/####/libomnwdo.so-32
/data/data/####/libomnwdo.so-64
/data/data/####/libomnwdo.so-64 (deleted)
/data/data/####/libpuuqlu.so
/data/data/####/libpuuqlu.so-32
/data/data/####/libpuuqlu.so-64
/data/data/####/lijian.jar
/data/data/####/m2.jar
/data/data/####/m3.jar
/data/data/####/m4.jar
/data/data/####/m5.jar
/data/data/####/m6.jar
/data/data/####/m7.jar
/data/data/####/mediv.jar
/data/data/####/mkv.xml
/data/data/####/oqoyet.png
/data/data/####/owsddza.xml
/data/data/####/prdopt.xml
/data/data/####/qweswws.data-journal
/data/data/####/qwevwwssww.xml
/data/data/####/qwevwwssww.xml.bak (deleted)
/data/data/####/rq_file.xml
/data/data/####/spu_ti.xml
/data/data/####/sunn.jar
/data/data/####/sunn.tmp (deleted)
/data/data/####/sunn.x
/data/data/####/swwkwsghf.data-journal
/data/data/####/t2pr.xml
/data/data/####/tiemwsts.jar
/data/data/####/tmp7.xml
/data/data/####/tools8977.xml
/data/data/####/tools8978.xml
/data/data/####/umengCache_17.jar
/data/data/####/umengDown5_2.jar
/data/data/####/umeng_down1.jar
/data/data/####/umeng_down13_4.jar
/data/data/####/umeng_down15.jar
/data/data/####/umeng_down18.jar
/data/data/####/umeng_down24_1.jar
/data/data/####/umeng_down3.jar
/data/data/####/umeng_down4_1.jar
/data/data/####/umeng_down9.jar
/data/data/####/umengsCache2.jar
/data/data/####/webview.db-journal
/data/data/####/webviewCookiesChromium.db-journal
/data/data/####/wiwsf.xml
/data/data/####/wiwsf.xml.bak
/data/data/####/wiwsf.xml.bak (deleted)
/data/data/####/wo94ws.xml
/data/data/####/wuy6t6f.data-journal
/data/data/####/wwswswewax.xml
/data/data/####/yd_config_c.xml
/data/media/####/.YiAds.log
/data/media/####/.YiAds_Net.log
/data/media/####/.ef0b4ddacc046d054f437ba0af966623
/data/media/####/.lju
/data/media/####/.nomedia
/data/media/####/.usdis
/data/media/####/.wq
/data/media/####/1723D6044EA97DA846C4E3A2E2999116.jar
/data/media/####/1723D6044EA97DA846C4E3A2E2999116.temp
/data/media/####/226C6D0262EDF21275151A3830CCD201.temp
/data/media/####/37CF6BD4BA0A29794B0857B09C00DCE5.jar
/data/media/####/37CF6BD4BA0A29794B0857B09C00DCE5.temp
/data/media/####/41B044BC0D9AD6EFABDFCDAA837E677A.temp
/data/media/####/6067CD2BC58AF269E2045AB73920FC13
/data/media/####/AC7D79D8E346210837DAD001BF9C25D0
/data/media/####/_pn
/data/media/####/_shn
/data/media/####/date40003000700
/data/media/####/engc.jar
/data/media/####/f12a251accb94dd34e2ea9aab9193efe.xml
/data/media/####/fdpi.jar
/data/media/####/pidfile.txt
/data/media/####/plg.dat

Miscellaneous:

Executes the following shell scripts:

/system/bin/cat /proc/cpuinfo
cat /proc/bus/input/devices
cat /proc/cpuinfo
cat /sys/class/net/wlan0/address
getprop
getprop ro.build.display.id
getprop ro.build.version.opporom
getprop ro.miui.ui.version.name
getprop ro.vivo.os.build.display.id

Loads the following dynamic libraries:

liblg9417791
libomnwdo
libpuuqlu

Uses the following algorithms to encrypt data:

AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding
Des-ECB-NoPadding
RSA-None-PKCS1Padding

Uses the following algorithms to decrypt data:

AES
AES-CBC-NoPadding
AES-CBC-PKCS5Padding
AES-CBC-PKCS7Padding
AES-ECB-PKCS5Padding
DES
DES-CBC-PKCS5Padding
DES-ECB-PKCS5Padding
Des-ECB-NoPadding
RSA-None-PKCS1Padding

Accesses the ITelephony private interface.

Gets information about location.

Gets information about network.

Gets information about phone status (number, IMEI, etc.).

Gets information about installed apps.

Gets information about running apps.

Adds tasks to the system scheduler.

Displays its own windows over windows of other apps.

Technologies

Terminology

Training and education

Myths

Technical information

Curing recommendations

Free trial